fix in fs/proc/generic.c: comparing unsigned int

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In function proc_file_read(), if variable nbytes becomes "negative" it lead to a possibe overrun and segfault.
It can become negative if the function dp->read_proc() returns n > nbytes.

When nbyte is negative, the while comparaison is unsigned (size_t nbytes), and the check is always TRUE.

This patch corrects the problem by using a int variable.

diff -ur linux-2.4.28-pre4/fs/proc/generic.c linux-2.4.28-pre4-fix/fs/proc/generic.c
- --- linux-2.4.28-pre4/fs/proc/generic.c 2004-10-22 11:40:42.000000000 -0400
+++ linux-2.4.28-pre4-fix/fs/proc/generic.c 2004-10-22 11:33:19.000000000 -0400
@@ -57,14 +57,15 @@
~ char *start;
~ struct proc_dir_entry * dp;
~ loff_t pos = *ppos;
+ int bytes_left = nbytes;

~ dp = (struct proc_dir_entry *) inode->u.generic_ip;
~ if (!(page = (char*) __get_free_page(GFP_KERNEL)))
~ return -ENOMEM;

- - while ((nbytes > 0) && !eof)
+ while ((bytes_left > 0) && !eof)
~ {
- - count = MIN(PROC_BLOCK_SIZE, nbytes);
+ count = MIN(PROC_BLOCK_SIZE, bytes_left);
~ if ((unsigned)pos > INT_MAX)
~ break;

@@ -115,7 +116,7 @@
~ }

~ pos += start < page ? (long)start : n; /* Move down the file */
- - nbytes -= n;
+ bytes_left -= n;
~ buf += n;
~ retval += n;
~ }

- --

==============         +----------------------------------------------+
Martin Gadbois         | "Politics may come and go, but Greed goes on |
S/W Developper         | forever" --Qeng Ho motto, Fire upon the Deep |

Colubris Networks Inc. +----------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBeVVV9Y3/iTTCEDkRAgjaAJ4tH4U7g/kP23DI96i8/h9jUcM/EgCfa56F S8oRN77DrSNBMjr2b++HkO4=
=szpU
-----END PGP SIGNATURE-----